Check provider logo

S3 bucket policy does not allow public write access

s3_bucket_policy_public_write_access

Severitycritical
Services3
by Prowler
internet-exposed

Amazon S3 bucket policies are evaluated for public write permissions (e.g., s3:PutObject, s3:Delete*, or s3:*). Account or bucket Public Access Block that restricts public buckets is considered when determining exposure.

Risk

Public write access lets anyone upload, overwrite, or delete objects, undermining integrity and availability. Attackers can plant malware, stage phishing content, poison data, or wipe buckets, causing outages and potential legal and cost impacts from storage abuse and content hosting.

Run this check with Prowler CLI

prowler aws --checks s3_bucket_policy_public_write_access

Run in Prowler Cloud
Fix finding with Prowler CLI

prowler aws --checks s3_bucket_policy_public_write_access --fixer

Recommendation

Restrict writes to trusted principals using least privilege; avoid Principal: "*". Enable Public Access Block at account and bucket levels for defense in depth. Prefer IAM roles over broad bucket policies, require private access paths, and enable versioning to recover from unwanted changes.

Remediation

CLI

aws s3api put-public-access-block --bucket <BUCKET_NAME> --public-access-block-configuration RestrictPublicBuckets=true

Native IaC
Terraform
Other
  1. Open the AWS S3 console and select the target bucket
  2. Go to the Permissions tab
  3. Under Block public access (bucket settings), click Edit
  4. Enable "Block public and cross-account access to buckets and objects through any public bucket or access point policies"
  5. Click Save changes

Source Code

Resource Type

AwsS3Bucket

References